PAIA manual

Last updated: 9 November 2026

1. Our details

• Private body: Good Legal Inc., a law practice regulated by the Legal Practice Council
• Head of the private body and Information Officer: Keryn de Vries, director
• Email: keryn@goodlegal.co.za
• Phone: +27 73 940 2017
• Postal and street address: available on request from the Information Officer
• Website: goodlegal.co.za

2. The Information Regulator’s guide

Section 10 of PAIA requires the Information Regulator to publish a guide on how to use PAIA and POPIA to exercise your rights. The guide is available in every official language from the Information Regulator’s website, inforegulator.org.za, and from its offices at JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001. You can contact the Regulator at enquiries@inforegulator.org.za.

3. Records available without a request

The information on this website, including our privacy policy and this manual, is available to anyone without a formal request. We have not published a notice under section 52 of PAIA.

4. Records kept in terms of other legislation

We keep records as required by, among others, the following laws, where they apply to us:

• Basic Conditions of Employment Act 75 of 1997
• Companies Act 71 of 2008
• Compensation for Occupational Injuries and Diseases Act 130 of 1993
• Consumer Protection Act 68 of 2008
• Electronic Communications and Transactions Act 25 of 2002
• Employment Equity Act 55 of 1998
• Financial Intelligence Centre Act 38 of 2001
• Income Tax Act 58 of 1962
• Labour Relations Act 66 of 1995
• Legal Practice Act 28 of 2014, and the rules and code of conduct made under it
• Occupational Health and Safety Act 85 of 1993
• Promotion of Access to Information Act 2 of 2000
• Protection of Personal Information Act 4 of 2013
• Skills Development Levies Act 9 of 1999
• Tax Administration Act 28 of 2011
• Unemployment Insurance Act 63 of 2001 and Unemployment Insurance Contributions Act 4 of 2002
• Value-Added Tax Act 89 of 1991

5. Subjects and categories of records we hold

• Company records: Memorandum of incorporation, records of directors, resolutions and statutory registers.
• Financial and tax records: Accounting records, annual financial statements, banking records, invoices, and tax and VAT records.
• Practice and regulatory records: Legal Practice Council registration and certificates, trust accounting records where applicable, and compliance records.
• Client records: Engagement letters and retainer agreements, identity verification records, client files, correspondence and billing records. These are generally confidential and often privileged.
• Employee and contractor records: Employment contracts, personnel records, payroll, leave, tax and benefits records.
• Supplier and operator records: Agreements and correspondence with suppliers and service providers, including data processing terms.
• Website and IT records: Enquiries sent through the website contact form (with the consent given), and technical and security records.

Listing a category does not mean that records in it will be made available. Access is subject to the grounds for refusal in PAIA (section 7 below).

6. Personal information we process

Purposes. To respond to enquiries; to provide legal services and manage client relationships; to employ and manage staff; to procure goods and services; to keep accounting, tax and regulatory records; to verify client identity as the law requires; and to keep our systems secure.

Categories of data subjects and information.

• Clients and prospective clients (individuals and businesses, and the people who represent them): names, contact details, identity and registration details, details of their matters, correspondence and billing information.
• Other parties to client matters: names, contact details and information relevant to the matter.
• Employees and contractors: identity and contact details, qualifications, employment, payroll, tax and banking details.
• Suppliers and service providers: names, contact, banking and contract details.
• Website visitors: details given through the contact form, and technical information used for security.

Recipients. Our service providers (operators), currently Cloudflare (website hosting, database and email forwarding) and Google (email); people involved in a client’s matter where the matter requires it; our auditors and professional advisers; and regulators, courts and authorities where the law requires.

Planned cross-border transfers. Cloudflare and Google may store or process personal information outside South Africa, including in Europe and the United States, under data processing terms that meet section 72 of POPIA.

Security measures. Encrypted connections, access limited to the people who need it, service providers with recognised security practices, confidentiality obligations, and a process for notifying the Information Regulator and affected people of any security compromise.

7. How to request access to a record

• Use the prescribed request form (Form 2 of the PAIA Regulations, available from the Information Regulator’s website) and send it to the Information Officer at keryn@goodlegal.co.za.
• Give enough detail for us to identify the record and you, say how you want to receive access, and explain which right you want to exercise or protect and why the record is needed for it (section 53 of PAIA). If you are asking on someone else’s behalf, include proof of your authority.
• Fees. A request fee and, if access is granted, an access fee may be payable, at the amounts prescribed in the PAIA Regulations. We will tell you of any fee before processing your request. No request fee is payable if you are asking for your own personal information.
• Time to respond. We will decide within 30 days of receiving a complete request. We may extend this once, by up to 30 days, in the circumstances section 57 of PAIA allows, and will tell you if we do.
• Grounds for refusal. We may or must refuse access on the grounds in Chapter 4 of Part 3 of PAIA, including to protect the privacy of third parties, commercial and confidential information, and records privileged from production in legal proceedings. Because we are a law practice, much of what we hold about clients is confidential and privileged.
• If you disagree. If your request is refused or you are unhappy with our decision, you can complain to the Information Regulator, or apply to court, within 180 days of our decision.

8. Availability of this manual

This manual is published on our website. You can also ask the Information Officer for a copy by email, free of charge. We will update it whenever our details or practices change.